18 SEP 2019 SEC WGM Minutes

Joint WG In-depth discussion - EHR hosting SEC, FHIR-I CBCP SOA

Security topics for the agenda

• PSAF Vol3 Provenance Ballot Outcome - Mike Davis
• Model-based Transformation Service - Matt Lord
  
• GDPR FHIR IG Update - Alex Mense
• FHIR Connectathon Findings - John Moehrke
• Sharing with Protections - Mike Davis

Joint FHIR Privacy and Security Topics 

• FHIRcast Updates - Isaac Vetter - see FHIRcast slides
• STU1 ballot status
• Connectathon report-out
• Plans for STU2
  • security & websockets
• Wg discussion follow-up: OAuth2 scope syntax - Josh M's DevDays presentation, overview of structured OAuth2 scopes
• Basic Provenance IG Ballot Outcome & Reconciliation - Brett Marquard/Russ Ott

Security hosting CBCP and FHIR-I

FYI: (note 16 CR are approved but not yet applied - sorry, will get to it soon)

1. couple of projects using compartments and some security tags --
2. Query is Execute - explained
3. Audit recommendation to include subject/patient whenever possible
4. inclusion of ISO lifecycle events 
5. add a query parameter on Provenance activity
6. add to Provenance pointers to known IG starting with QEDm
7. add to auditEvent a severity element
8. add reference to security model - udap
9. improve text around Provenance and transform actions
10. FIx some issues with mapping to DICOM 

TODO:

1. classification datatypes and core resources relative to De-Identification https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=24452&start=0
2. do we need a standardized method to enable provisioning of a patient user identity? https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=23776&start=0 
3. Provenance and relevantHistory - https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=20758&start=0
4. Query on Provenance.target when guidance is to use versioned id in Provenance.target -- grahame has indicated that servers should know to index only the non-version portion of the id in .target. Which then brings up the question of how to find the specific Provenance for a specific version, which is to be handled as a client side inspection of the full results for the one Provenance with that version in .target. -- not yet a CP
5. Provenance.target pointing more finegrain at elements within Resource that were modified https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=23076&start=0 
6. provenance.activity valueset is not useful, needs atleast ehr lifecycle https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=23712&start=0 **** 22104 has already agreed to use the codes from audit which include lifecycle. So what more is needed, and if more is needed it should be added to the one valueset not have divergent valuesets.
7. any other open issue 

Vocabulary synchronization issues***. security tag for "COPY" -- is this vocabulary ready to be used? https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemEdit&tracker_item_id=19311&start=0

GDPR Session

• GDPR FHIR IG - Alex Mense